SAP Security Patch Day August 2026 | RedRays

Executive Summary

• Critical Code Injection via SSRF: CVE-2026-44772 (CVSS 9.9) in SAP Manufacturing Integration and Intelligence lets a low-privileged authenticated attacker exploit a server-side request forgery flaw during XSL transformations to execute arbitrary commands, with a changed scope and complete compromise of confidentiality, integrity, and availability. Since no workaround is available, the patch is the only remedy.
• Critical Memory Corruption: CVE-2026-34265 (CVSS 9.8) in SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to corrupt memory through improper validation of boundary conditions in DIAG protocol parsing, with high impact on confidentiality, integrity, and availability. Since no workaround is available, the patch is the only remedy.
• Critical Code Injection: CVE-2026-44758 (CVSS 9.1) in SAP Manufacturing Integration and Intelligence lets a high-privileged attacker exploit the IllumXSLTServlet component to execute arbitrary operating system commands, with a changed scope and complete compromise of confidentiality, integrity, and availability.

Code Injection Vulnerability in SAP Manufacturing Integration and Intelligence (XSL Transformation)

A code injection vulnerability in SAP Manufacturing Integration and Intelligence, rooted in a server-side request forgery during XSL transformations, allows a low-privileged authenticated attacker to execute arbitrary commands. Because the scope changes, successful exploitation results in complete compromise of confidentiality, integrity, and availability. So far SAP states there is no workaround; after patching, administrators must also enable the new Secure Transformer system property and populate the Allowed Hosts field.

Memory Corruption Vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform

A memory corruption vulnerability in SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to corrupt memory through improper validation of boundary conditions in DIAG protocol parsing, potentially disclosing sensitive system information or crashing the system outright. As a result, successful exploitation compromises confidentiality, integrity and availability completely. So far SAP states there is no workaround and marks the issue as externally reported.

Code Injection Vulnerability in Manufacturing Integration and Intelligence (IllumXSLTServlet)

A code injection vulnerability in the IllumXSLTServlet component of SAP Manufacturing Integration and Intelligence, used for XSL transformations, allows a high-privileged attacker to submit specially crafted input and execute arbitrary commands on the underlying operating system. Because the scope changes, successful exploitation results in complete compromise of confidentiality, integrity, and availability. SAP has now removed the vulnerable servlet entirely. Until the patch lands, do not assign the XMII_IllumXSLTServlet action to any role, since no role shipped with MII carries it by default.

Potential Buffer Overflow Vulnerability Affects SAP Commerce Cloud in Public-Cloud Deployments with NGINX

SAP Commerce Cloud in public cloud deployments bundled an affected version of NGINX Open Source, a flaw in the third-party component rather than in SAP’s own code. However, an unauthenticated attacker could still trigger memory corruption under complex conditions, with high impact on confidentiality, integrity, and availability. SAP has already deployed the patch to its public cloud environments, but customers must rebuild and redeploy their applications to consume it, since no workaround exists.

Credentials Disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server)

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials using a hard-coded cryptographic key. So an attacker with high privileges and local access to the server can retrieve and decrypt those credentials. Because the scope changes, successful exploitation results in high impact on confidentiality and integrity, with no impact on availability. However there is no workaround, so systems that held secondary credentials before the upgrade must follow SAP KBA 3763536 to rotate and recode them.

Directory Traversal Vulnerability in SAP Manufacturing Integration and Intelligence

A directory traversal vulnerability in SAP Manufacturing Integration and Intelligence allows a high-privileged attacker, under complex conditions and with user interaction, to write files outside the intended directory via the SSCE interface. Because the scope changes, successful exploitation results in complete compromise of confidentiality, integrity, and availability. Until the patch is applied, grant the XMII_Developer role only when necessary and apply SAP Note 3158613.

Remote Code Execution Vulnerability in Enhanced Change and Transport System (CTS+) Attach Tool (ctsattach)

SAP has discontinued the Enhanced Change and Transport System (CTS+) attach tool, ctsattach, after finding that insecure deserialization in a third-party library it relies on can lead to remote code execution. Before the tool was withdrawn, a low-privileged authenticated attacker could supply a crafted archive file that, once a victim processed it with the tool, executes code and compromises the system, resulting in high impact on confidentiality and integrity and low impact on availability. Because every released version carries the flaw, SAP issues no patch at all and instead tells customers to stop using ctsattach immediately and delete every copy from every system. SAP also re-released this note on 11 August 2026, since the Title, Other Terms, Reason and Prerequisites and Solution sections all changed.

Missing Authorization Check in SAP Manufacturing Integration and Intelligence (Scheduling)

A missing authorization check in SAP Manufacturing Integration and Intelligence allows an unauthenticated remote attacker to access scheduling-related application functions without proper authorization validation. As a result, the attacker can retrieve, create, modify or delete application-managed scheduling data, with low impact on confidentiality, integrity, and availability. So far SAP states that no workaround is available, and the fix requires the affected configuration page to demand additional role assignments.

Missing Authorization Check in SAP Manufacturing Integration and Intelligence (Cost Servlet)

SAP Manufacturing Integration and Intelligence is missing an authorization check on its Cost Servlet, allowing an unauthenticated attacker to send crafted requests with specific parameter values to reach backend operations. Once inside, the attacker can read, create, modify or delete application-managed business data, with low impact on confidentiality, integrity, and availability. Since no workaround is available, the patch is the only remedy; only the Support Package patch resolves the issue.

Multiple Vulnerabilities in SAP Business AI Platform (Approuter)

SAP’s security note for the Approuter component of SAP Business AI Platform bundles eleven separate vulnerabilities. The headline issue, CVE-2026-58230, is an information disclosure flaw rated 7.0: the Approuter does not sufficiently validate certain token content under specific configurations, so an unauthenticated attacker can send a crafted token that causes sensitive credential material to be sent to a destination the attacker controls, with high impact on confidentiality and low impact on integrity and availability.

The other ten, with the per-issue scores SAP prints, are improper certificate validation CVE-2026-66760 (6.4), missing authorization check CVE-2026-66777 (5.9), improper authentication CVE-2026-66776 (5.9), missing authorization check on the WebSocket CVE-2026-58237 (5.9), denial of service CVE-2026-58238 (5.9), HTTP request smuggling CVE-2026-66778 (5.3), denial of service CVE-2026-66761 (4.3), cross-site request forgery CVE-2026-66775 (4.3), denial of service CVE-2026-66774 (3.7), and identity spoofing CVE-2026-58239 (3.7).

However, each carries its own precondition, such as the service2approuter flow being supported, a WebSocket configured with XSUAA scopes in xs-app.json, IAS with back-channel logout, or Redis being installed. First, before the upgrade, scope the XSUAA redirect-uris configuration as described in SAP Note 3741519, which SAP requires. Then upgrade the Node.js package @sap/approuter to version 23.0.0 or above, which is the fix itself. Meanwhile SAP offers two temporary workarounds: bind IAS to the Approuter with x509 credentials for the information disclosure issue, and set STATE_PARAMETER_SECRET to true explicitly for the cross-site request forgery issue.

XML External Entity Injection in SAP BusinessObjects Business Intelligence (Web Intelligence)

SAP BusinessObjects Business Intelligence Platform’s Web Intelligence component allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external XML references. Then, when the file is processed as a data source, the component resolves those references and exposes the contents of sensitive server-side files, resulting in high impact on confidentiality with no impact on integrity or availability.

Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver Application Server ABAP (Unified Rendering)

SAP NetWeaver Application Server ABAP’s Unified Rendering framework did not handle certain error situations securely, allowing a low-privileged attacker to craft a malicious link that, once a second authenticated victim opens it, reflects injected content in the DOM and executes in the victim’s browser session. Successful exploitation results in high impact on confidentiality, low impact on integrity, and no impact on availability. Therefore the fix requires upgrading to Unified Rendering version 2604 or later.

Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services)

SAP NetWeaver Application Server Java, through its Adobe Document Service, bundled outdated OpenSSL and libcurl libraries carrying known vulnerabilities. Although SAP states that no specific exploit is currently known, a low-privileged authenticated attacker could leverage those weaknesses, with low impact on confidentiality, integrity, and availability. So SAP updates Adobe Document Service to OpenSSL 3.0.20 and libcurl 8.19.0, although the note never lists the individual upstream CVE identifiers.

SQL Injection Vulnerability in SAP Social Intelligence

SAP Social Intelligence has an SQL injection vulnerability that lets a low-privileged authenticated attacker inject an SQL DDL string directly into the underlying database without further authorization checks. As a result, an attacker can make malicious changes to the database structure, with low impact on confidentiality, integrity, and availability. Instead of patching around it, SAP resolves the issue by removing the vulnerable functionality outright.

Cross Site Scripting (XSS) Vulnerability in SAPUI5

SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into a persisted application change; when another user later opens the adapted application, the injected script executes in that victim’s browser session. Successful exploitation could allow the attacker to access sensitive session data and perform unauthorized actions on the victim’s behalf, with high impact on confidentiality and integrity and no impact on availability. Because exploitation requires key user privileges in an application using UI5 Flexibility, no backend compromise or OData manipulation is needed.

Code Injection Vulnerability in SAP FICA ODN Framework

SAP FICA ODN framework contains a code injection flaw. Because the value is not validated, a high-privileged authenticated user can inject it into a local variable that the application later executes, letting that user control application behavior, resulting in high impact on integrity and low impact on availability with no impact on confidentiality. However the note applies only to systems running the FICA ODN solution, and SAP re-released it on 11 August 2026 with an updated Solution section.

OS Command Injection Vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform

SAP NetWeaver Application Server ABAP and ABAP Platform contain an internal code path that reaches operating-system process-execution routines without a sufficient security gate, authorization check, or allow-list validation. So an attacker who already holds high privileges can execute OS-level commands, including commands that write to the operating system or stop the SAP system, with no impact on confidentiality, low impact on integrity, and high impact on availability. So far SAP states there is no workaround and requires customers to apply the kernel patch.

Memory Corruption Vulnerability in SAPSPrint Service

The SAPSPrint Service contains a stack-based buffer overflow. Because the input length is never checked, an unauthenticated attacker can send a crafted request over the network that triggers memory corruption and crashes the service and automatically restart, with low impact on availability and no impact on confidentiality or integrity. So far SAP states there is no workaround. The affected service runs on Windows.

Memory Corruption Vulnerability in SAP ABAP Platform

SAP ABAP Platform allows an unauthenticated attacker to send a specially crafted request to an internal dispatcher component. Since input was never terminated, the memory refresh stayed incomplete, so limited non-sensitive data can be disclosed left over from previously used memory, resulting in low impact on confidentiality with no impact on integrity or availability. SAP fixes it by implementing proper input termination in the affected kernel patch levels.

Missing Authorization Check in SAP S/4HANA (Reprocess Bank Statement Items)

SAP S/4HANA’s Reprocess Bank Statement Items function is missing a required authorization check. So an authenticated user can invoke processing rules that nobody ever shared with them, resulting in privilege escalation with low impact on confidentiality and no impact on integrity or availability. For a complete fix, SAP also requires Notes 3775098 and 3790190.

Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools)

SAP BusinessObjects Business Intelligence Platform’s Admin Tools do not perform a sufficient authorization check on certain administrative functionality. Therefore an attacker authenticated only as a non-administrative user can bypass that restriction to gain limited information about the affected functionality, with low impact on confidentiality and no impact on integrity or availability. The fix denies non-administrative users access to Admin Tools.

Missing Authorization Check in SAP Manufacturing Integration and Intelligence (MII)

SAP Manufacturing Integration and Intelligence does not perform a necessary authorization check on a certain application function. As a result, a low-privileged authenticated attacker can read user account information that only privileged users should see, which an attacker can then use to mount further attacks against those accounts, resulting in low impact on confidentiality with no impact on integrity or availability.

Missing Authorization Check in SAP NetWeaver and ABAP Platform (Change and Transport System – Customer Transport Integration Wizard)

The Customer Transport Integration Wizard within the Change and Transport System of SAP NetWeaver and ABAP Platform does not enforce authorization checks on its core functionality when reached through a specific transaction. However, the attack only works if the relevant ICF service nodes have already been activated by an administrator, to modify configuration tables that control access to data objects, with low impact on integrity and availability and no impact on confidentiality. Until the patch is applied, deactivate the ICF service node SCTS_UPGINT_CHECK_CONFIG in transaction SICF.

Hard-Coded Credentials in SAP Advanced Planning and Optimization (Model Mix Planning)

SAP Advanced Planning and Optimization, in its Model Mix Planning component, contains a hardcoded credential in the application source code that performs an authorization check. Because the credential is fixed in the source, an attacker who already holds high privileges can bypass authorization and delete planning-related restrictions, resulting in low impact on confidentiality and integrity with no impact on availability.

Security Misconfiguration in SAP Data Services Management Console

SAP Data Services Management Console ships with an overly permissive Content Security Policy that omits certain restrictive directives. So an authenticated attacker who also holds a second vulnerability to chain against can use this gap, under complex conditions and with user interaction, to inject and execute malicious scripts inside the application’s context, resulting in low impact on confidentiality and integrity with no impact on availability.